Is CVE-2016-9317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9317 being exploited in the wild.

How severe is CVE-2016-9317?

Medium severity, with a CVSS score of 5.5, published 26 January 2017.

Is there a fix for CVE-2016-9317?

A patch was published on 2017-01-31: Debian released security update DSA-3777-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9317 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-9317?

Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9317: libgd denial of service in gdImageCreate

CVE-2016-9317 · Severity: medium · CVSS 5.5 · Published 2017-01-26

The GD Graphics Library, a widely used tool for creating and editing images programmatically, contains a flaw in how it handles very large images. An attacker can provide a specially crafted, oversized image that causes the system to hang or become unresponsive. This results in a denial of service, potentially crashing web servers or applications that process user-uploaded images.

Technologies: Libgd. Vendors: Libgd.

Quick answers

Is CVE-2016-9317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9317 being exploited in the wild.
How severe is CVE-2016-9317?: Medium severity, with a CVSS score of 5.5, published 26 January 2017.
Which products and versions are affected?: libgd libgd before 2.2.4.
Is there a fix for CVE-2016-9317?: A patch was published on 2017-01-31: Debian released security update DSA-3777-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9317 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-9317?: Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in libgd's gdImageCreate function due to improper input validation of image dimensions. The function fails to perform overflow checks when allocating memory for new images, a protection that was already present in the related gdImageCreateTrueColor function. By providing an image with extremely large dimensions, a remote attacker can trigger a system hang or resource exhaustion. This issue is resolved in version 2.2.4 by implementing the missing overflow checks.

Affected products

libgd libgd before 2.2.4

Timeline

2017-01-26: advisory: NVD publication date
2017-01-31: patched: Debian released security update DSA-3777-1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.